Pass --header enrollment option to fleet-server
#8071
Conversation
|
This pull request does not have a backport label. Could you fix it @blakerouse? 🙏
|
blakerouse
added
Team:Elastic-Agent-Control-Plane
|
Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane) |
|
💚 Build Succeeded
cc @blakerouse |
| kind: enhancement | ||
|
|
||
| # Change summary; a 80ish characters long description of the change. | ||
| summary: Add --header to enrollment communication with Fleet Server |
There was a problem hiding this comment.
| summary: Add --header to enrollment communication with Fleet Server | |
| summary: Use --header from enrollment when communicating with Fleet Server |
The current version doesn't quite read correctly as a sentence to me.
| Path string `config:"path" yaml:"path,omitempty"` | ||
| Host string `config:"host" yaml:"host,omitempty"` | ||
| Hosts []string `config:"hosts" yaml:"hosts,omitempty"` | ||
| Headers map[string]string `config:"headers" yaml:"headers,omitempty"` |
There was a problem hiding this comment.
If the headers are secrets, is this going to leak them in diagnostics? Are they either already redacted or not included in diagnostics at all?
| func(t *testing.T) *http.ServeMux { | ||
| mux := http.NewServeMux() | ||
| mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { | ||
| if r.Header.Get("X-Test-Header") != "Test-Value" { |
There was a problem hiding this comment.
This proves we use a header for /enroll, is this enough to also prove the same header would be included in a checkin?
I see in enroll.go we explicitly add the header to enrollCmdOption so it isn't obvious just by reading it. Regardless, would there be a way to test that?
What does this PR do?
Currently the
--headerenrollment flag is used when bootstrapping Fleet Server. Those headers should also be used when communicating with Fleet Server that is not being bootstrapped.Why is it important?
When enrolling to a Fleet Server that is behind a proxy that requires specific headers for communication it is not possible to enroll the Elastic Agent into the Fleet Server.
Checklist
[ ] I have made corresponding change to the default configuration files./changelog/fragmentsusing the changelog tool[ ] I have added an integration test or an E2E test(covered well in unit tests)Disruptive User Impact
None
How to test this PR locally
Setup a Fleet Server behind a proxy that requires a specific header for traffic to flow. Then enroll the elastic-agent with the required header:
./elastic-agent enroll --url http://proxy-url --enrollment-token ${token} --header X-Custom-Header=TESTRelated issues